labeler.yml: set top-level read-only permissions (#9862)

Author: pnacht

.github/workflows/labeler.yml

@@ -2,13 +2,15 @@ name: "Pull Request Labeler"
 on:
   - pull_request_target
 
+permissions:
+  contents: read
+
 jobs:
   triage:
     permissions:
-      contents: read
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/labeler@v4
         with:
-          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"